@rekog/mcp-nest 1.7.1 → 1.7.2

package/README.md

@@ -33,7 +33,7 @@ With `@rekog/mcp-nest` you define tools, resources, and prompts in a way that's
 ## Installation
 
 ```bash
-npm install @rekog/mcp-nest @modelcontextprotocol/sdk zod
+npm install @rekog/mcp-nest @modelcontextprotocol/sdk zod@^3
 ```
 
 ## Quick Start

package/dist/authz/adapters/github.adapter.d.ts

@@ -0,0 +1,40 @@
+import { Logger } from '@nestjs/common';
+import { IOAuthStore } from '../stores/oauth-store.interface';
+import { OAuthModuleOptions } from '../providers/oauth-provider.interface';
+export declare class GitHubAdapter {
+    private readonly store;
+    private readonly options;
+    private readonly logger;
+    constructor(store: IOAuthStore, options: OAuthModuleOptions);
+    static create(name: string): {
+        new (name: string): {
+            readonly logger: Logger;
+            readonly name: string;
+            find(id: string): Promise<any | null>;
+            findClient(clientId: string): Promise<any | null>;
+            findSession(sessionId: string): Promise<any | null>;
+            findToken(tokenId: string): Promise<any | null>;
+            findGrant(grantId: string): Promise<any | null>;
+            formatClientForOidc(client: any): any;
+            findByUserCode(userCode: string): Promise<any | null>;
+            findByDeviceInfo(deviceInfo: any): Promise<any | null>;
+            upsert(id: string, payload: any, expiresIn?: number): Promise<void>;
+            upsertClient(clientId: string, payload: any): Promise<void>;
+            upsertSession(sessionId: string, payload: any, expiresAt?: number): Promise<void>;
+            upsertToken(tokenId: string, payload: any, expiresAt?: number): Promise<void>;
+            upsertGrant(grantId: string, payload: any, expiresAt?: number): Promise<void>;
+            destroy(id: string): Promise<void>;
+            destroyClient(clientId: string): Promise<void>;
+            destroySession(sessionId: string): Promise<void>;
+            destroyToken(tokenId: string): Promise<void>;
+            destroyGrant(grantId: string): Promise<void>;
+            revokeByGrantId(grantId: string): Promise<void>;
+            consume(id: string): Promise<void>;
+        };
+    };
+    static findAccount(ctx: any, id: string): Promise<{
+        accountId: string;
+        claims(use: string, scope: string): Promise<any>;
+    }>;
+}
+//# sourceMappingURL=github.adapter.d.ts.map

package/dist/authz/adapters/github.adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.adapter.d.ts","sourceRoot":"","sources":["../../../src/authz/adapters/github.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAS3E,qBACa,aAAa;IAIC,OAAO,CAAC,QAAQ,CAAC,KAAK;IAE7C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;gBAGf,KAAK,EAAE,WAAW,EAEzC,OAAO,EAAE,kBAAkB;IAO9C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM;mBAIY,MAAM;6BAFhB,MAAM;2BAEI,MAAM;qBAOzB,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;iCAmCT,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;mCAgB1B,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;+BAShC,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;+BAS5B,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;wCAQzB,GAAG,GAAG,GAAG;qCAgBb,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;yCAQxB,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;uBAStD,MAAM,WACD,GAAG,cACA,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;mCAwCoB,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;qCAS3D,MAAM,WACR,GAAG,cACA,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;iCASL,MAAM,WACN,GAAG,cACA,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;iCASL,MAAM,WACN,GAAG,cACA,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;wBAQE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;oCAsCH,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;sCAOpB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;kCAO1B,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;kCAOtB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;qCAO1B,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;wBAQnC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;;;WAW/B,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM;;oBAOvB,MAAM,SAAS,MAAM;;CA0B5C"}

package/dist/authz/adapters/github.adapter.js

@@ -0,0 +1,212 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var GitHubAdapter_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitHubAdapter = void 0;
+const common_1 = require("@nestjs/common");
+let GitHubAdapter = GitHubAdapter_1 = class GitHubAdapter {
+    constructor(store, options) {
+        this.store = store;
+        this.options = options;
+        this.logger = new common_1.Logger(GitHubAdapter_1.name);
+    }
+    static create(name) {
+        return class OidcAdapterInstance {
+            constructor(name) {
+                this.name = name;
+                this.logger = new common_1.Logger(`OidcAdapter:${name}`);
+            }
+            async find(id) {
+                this.logger.debug(`Finding ${this.name} with id: ${id}`);
+                try {
+                    switch (this.name) {
+                        case 'Client':
+                            const client = await this.findClient(id);
+                            return client ? this.formatClientForOidc(client) : null;
+                        case 'Session':
+                            return await this.findSession(id);
+                        case 'AccessToken':
+                        case 'RefreshToken':
+                        case 'AuthorizationCode':
+                        case 'IdToken':
+                            return await this.findToken(id);
+                        case 'Grant':
+                            return await this.findGrant(id);
+                        default:
+                            this.logger.warn(`Unknown adapter type: ${this.name}`);
+                            return null;
+                    }
+                }
+                catch (error) {
+                    this.logger.error(`Error finding ${this.name}:`, error);
+                    return null;
+                }
+            }
+            async findClient(clientId) {
+                return {
+                    client_id: clientId,
+                    client_secret: 'dummy_secret',
+                    redirect_uris: ['http://localhost:3000/callback'],
+                    grant_types: ['authorization_code', 'refresh_token'],
+                    response_types: ['code'],
+                    token_endpoint_auth_method: 'client_secret_basic',
+                };
+            }
+            async findSession(sessionId) {
+                return null;
+            }
+            async findToken(tokenId) {
+                return null;
+            }
+            async findGrant(grantId) {
+                return null;
+            }
+            formatClientForOidc(client) {
+                return {
+                    client_id: client.client_id,
+                    client_secret: client.client_secret,
+                    redirect_uris: client.redirect_uris || [],
+                    grant_types: client.grant_types || ['authorization_code'],
+                    response_types: client.response_types || ['code'],
+                    token_endpoint_auth_method: client.token_endpoint_auth_method || 'client_secret_basic',
+                    scope: client.scope || 'openid profile email',
+                };
+            }
+            async findByUserCode(userCode) {
+                this.logger.debug(`Finding ${this.name} by user code: ${userCode}`);
+                return null;
+            }
+            async findByDeviceInfo(deviceInfo) {
+                this.logger.debug(`Finding ${this.name} by device info`);
+                return null;
+            }
+            async upsert(id, payload, expiresIn) {
+                this.logger.debug(`Upserting ${this.name} with id: ${id}`);
+                try {
+                    const expiresAt = expiresIn
+                        ? Date.now() + expiresIn * 1000
+                        : undefined;
+                    switch (this.name) {
+                        case 'Client':
+                            await this.upsertClient(id, payload);
+                            break;
+                        case 'Session':
+                            await this.upsertSession(id, payload, expiresAt);
+                            break;
+                        case 'AccessToken':
+                        case 'RefreshToken':
+                        case 'AuthorizationCode':
+                        case 'IdToken':
+                            await this.upsertToken(id, payload, expiresAt);
+                            break;
+                        case 'Grant':
+                            await this.upsertGrant(id, payload, expiresAt);
+                            break;
+                        default:
+                            this.logger.warn(`Unknown adapter type for upsert: ${this.name}`);
+                    }
+                }
+                catch (error) {
+                    this.logger.error(`Error upserting ${this.name}:`, error);
+                    throw error;
+                }
+            }
+            async upsertClient(clientId, payload) {
+                this.logger.debug(`Client upsert: ${clientId}`, payload);
+            }
+            async upsertSession(sessionId, payload, expiresAt) {
+                this.logger.debug(`Session upsert: ${sessionId}`);
+            }
+            async upsertToken(tokenId, payload, expiresAt) {
+                this.logger.debug(`Token upsert: ${tokenId}, expires: ${expiresAt}`);
+            }
+            async upsertGrant(grantId, payload, expiresAt) {
+                this.logger.debug(`Grant upsert: ${grantId}`);
+            }
+            async destroy(id) {
+                this.logger.debug(`Destroying ${this.name} with id: ${id}`);
+                try {
+                    switch (this.name) {
+                        case 'Client':
+                            await this.destroyClient(id);
+                            break;
+                        case 'Session':
+                            await this.destroySession(id);
+                            break;
+                        case 'AccessToken':
+                        case 'RefreshToken':
+                        case 'AuthorizationCode':
+                        case 'IdToken':
+                            await this.destroyToken(id);
+                            break;
+                        case 'Grant':
+                            await this.destroyGrant(id);
+                            break;
+                        default:
+                            this.logger.warn(`Unknown adapter type for destroy: ${this.name}`);
+                    }
+                }
+                catch (error) {
+                    this.logger.error(`Error destroying ${this.name}:`, error);
+                    throw error;
+                }
+            }
+            async destroyClient(clientId) {
+                this.logger.debug(`Client destroy: ${clientId}`);
+            }
+            async destroySession(sessionId) {
+                this.logger.debug(`Session destroy: ${sessionId}`);
+            }
+            async destroyToken(tokenId) {
+                this.logger.debug(`Token destroy: ${tokenId}`);
+            }
+            async destroyGrant(grantId) {
+                this.logger.debug(`Grant destroy: ${grantId}`);
+            }
+            async revokeByGrantId(grantId) {
+                this.logger.debug(`Revoking ${this.name} by grant id: ${grantId}`);
+            }
+            async consume(id) {
+                this.logger.debug(`Consuming ${this.name} with id: ${id}`);
+            }
+        };
+    }
+    static async findAccount(ctx, id) {
+        const logger = new common_1.Logger('GitHubAdapter:findAccount');
+        logger.debug(`Finding account: ${id}`);
+        return {
+            accountId: id,
+            async claims(use, scope) {
+                logger.debug(`Getting claims for account ${id}, use: ${use}, scope: ${scope}`);
+                const claims = {
+                    sub: id,
+                };
+                if (scope.includes('profile')) {
+                    claims.preferred_username = id;
+                }
+                if (scope.includes('email')) {
+                }
+                return claims;
+            },
+        };
+    }
+};
+exports.GitHubAdapter = GitHubAdapter;
+exports.GitHubAdapter = GitHubAdapter = GitHubAdapter_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)('IOAuthStore')),
+    __param(1, (0, common_1.Inject)('OAUTH_MODULE_OPTIONS')),
+    __metadata("design:paramtypes", [Object, Object])
+], GitHubAdapter);
+//# sourceMappingURL=github.adapter.js.map

package/dist/authz/adapters/github.adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.adapter.js","sourceRoot":"","sources":["../../../src/authz/adapters/github.adapter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4D;AAYrD,IAAM,aAAa,qBAAnB,MAAM,aAAa;IAGxB,YACyB,KAAmC,EAE1D,OAA4C;QAFJ,UAAK,GAAL,KAAK,CAAa;QAEzC,YAAO,GAAP,OAAO,CAAoB;QAL7B,WAAM,GAAG,IAAI,eAAM,CAAC,eAAa,CAAC,IAAI,CAAC,CAAC;IAMtD,CAAC;IAMJ,MAAM,CAAC,MAAM,CAAC,IAAY;QACxB,OAAO,MAAM,mBAAmB;YAG9B,YAA4B,IAAY;gBAAZ,SAAI,GAAJ,IAAI,CAAQ;gBACtC,IAAI,CAAC,MAAM,GAAG,IAAI,eAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAKD,KAAK,CAAC,IAAI,CAAC,EAAU;gBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;gBAEzD,IAAI,CAAC;oBACH,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;wBAClB,KAAK,QAAQ;4BAEX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;4BACzC,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;wBAE1D,KAAK,SAAS;4BACZ,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;wBAEpC,KAAK,aAAa,CAAC;wBACnB,KAAK,cAAc,CAAC;wBACpB,KAAK,mBAAmB,CAAC;wBACzB,KAAK,SAAS;4BACZ,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;wBAElC,KAAK,OAAO;4BACV,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;wBAElC;4BACE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;4BACvD,OAAO,IAAI,CAAC;oBAChB,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;oBACxD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAKM,KAAK,CAAC,UAAU,CAAC,QAAgB;gBAGtC,OAAO;oBACL,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,cAAc;oBAC7B,aAAa,EAAE,CAAC,gCAAgC,CAAC;oBACjD,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;oBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;oBACxB,0BAA0B,EAAE,qBAAqB;iBAClD,CAAC;YACJ,CAAC;YAKM,KAAK,CAAC,WAAW,CAAC,SAAiB;gBAGxC,OAAO,IAAI,CAAC;YACd,CAAC;YAKM,KAAK,CAAC,SAAS,CAAC,OAAe;gBAGpC,OAAO,IAAI,CAAC;YACd,CAAC;YAKM,KAAK,CAAC,SAAS,CAAC,OAAe;gBAEpC,OAAO,IAAI,CAAC;YACd,CAAC;YAKM,mBAAmB,CAAC,MAAW;gBACpC,OAAO;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;oBACzC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,CAAC,oBAAoB,CAAC;oBACzD,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC;oBACjD,0BAA0B,EACxB,MAAM,CAAC,0BAA0B,IAAI,qBAAqB;oBAC5D,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,sBAAsB;iBAC9C,CAAC;YACJ,CAAC;YAKD,KAAK,CAAC,cAAc,CAAC,QAAgB;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,kBAAkB,QAAQ,EAAE,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAKD,KAAK,CAAC,gBAAgB,CAAC,UAAe;gBACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,iBAAiB,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAKD,KAAK,CAAC,MAAM,CACV,EAAU,EACV,OAAY,EACZ,SAAkB;gBAElB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;gBAE3D,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,SAAS;wBACzB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;wBAC/B,CAAC,CAAC,SAAS,CAAC;oBAEd,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;wBAClB,KAAK,QAAQ;4BACX,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;4BACrC,MAAM;wBAER,KAAK,SAAS;4BACZ,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;4BACjD,MAAM;wBAER,KAAK,aAAa,CAAC;wBACnB,KAAK,cAAc,CAAC;wBACpB,KAAK,mBAAmB,CAAC;wBACzB,KAAK,SAAS;4BACZ,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;4BAC/C,MAAM;wBAER,KAAK,OAAO;4BACV,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;4BAC/C,MAAM;wBAER;4BACE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;oBACtE,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC1D,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YAKM,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,OAAY;gBAEtD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;YAC3D,CAAC;YAKM,KAAK,CAAC,aAAa,CACxB,SAAiB,EACjB,OAAY,EACZ,SAAkB;gBAGlB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;YACpD,CAAC;YAKM,KAAK,CAAC,WAAW,CACtB,OAAe,EACf,OAAY,EACZ,SAAkB;gBAGlB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,cAAc,SAAS,EAAE,CAAC,CAAC;YACvE,CAAC;YAKM,KAAK,CAAC,WAAW,CACtB,OAAe,EACf,OAAY,EACZ,SAAkB;gBAGlB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;YAChD,CAAC;YAKD,KAAK,CAAC,OAAO,CAAC,EAAU;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;gBAE5D,IAAI,CAAC;oBACH,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;wBAClB,KAAK,QAAQ;4BACX,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;4BAC7B,MAAM;wBAER,KAAK,SAAS;4BACZ,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;4BAC9B,MAAM;wBAER,KAAK,aAAa,CAAC;wBACnB,KAAK,cAAc,CAAC;wBACpB,KAAK,mBAAmB,CAAC;wBACzB,KAAK,SAAS;4BACZ,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;4BAC5B,MAAM;wBAER,KAAK,OAAO;4BACV,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;4BAC5B,MAAM;wBAER;4BACE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,IAAI,CAAC,IAAI,EAAE,CACjD,CAAC;oBACN,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC3D,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YAKM,KAAK,CAAC,aAAa,CAAC,QAAgB;gBACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC;YAKM,KAAK,CAAC,cAAc,CAAC,SAAiB;gBAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;YACrD,CAAC;YAKM,KAAK,CAAC,YAAY,CAAC,OAAe;gBACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;YACjD,CAAC;YAKM,KAAK,CAAC,YAAY,CAAC,OAAe;gBACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;YACjD,CAAC;YAKD,KAAK,CAAC,eAAe,CAAC,OAAe;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,iBAAiB,OAAO,EAAE,CAAC,CAAC;YAErE,CAAC;YAKD,KAAK,CAAC,OAAO,CAAC,EAAU;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;YAE7D,CAAC;SACF,CAAC;IACJ,CAAC;IAMD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAQ,EAAE,EAAU;QAC3C,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,2BAA2B,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAGvC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAa;gBACrC,MAAM,CAAC,KAAK,CACV,8BAA8B,EAAE,UAAU,GAAG,YAAY,KAAK,EAAE,CACjE,CAAC;gBAGF,MAAM,MAAM,GAAQ;oBAClB,GAAG,EAAE,EAAE;iBACR,CAAC;gBAGF,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CAAC,kBAAkB,GAAG,EAAE,CAAC;gBAGjC,CAAC;gBAED,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAG9B,CAAC;gBAED,OAAO,MAAM,CAAC;YAChB,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAnVY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;IACrB,WAAA,IAAA,eAAM,EAAC,sBAAsB,CAAC,CAAA;;GALtB,aAAa,CAmVzB","sourcesContent":["import { Injectable, Inject, Logger } from '@nestjs/common';\nimport { IOAuthStore } from '../stores/oauth-store.interface';\nimport { OAuthModuleOptions } from '../providers/oauth-provider.interface';\n\n/**\n * GitHub Adapter for OIDC Provider\n *\n * This adapter bridges the gap between the OIDC provider and GitHub authentication.\n * It implements the oidc-provider adapter interface to store and retrieve\n * OIDC-related data while integrating with GitHub for user identity.\n */\n@Injectable()\nexport class GitHubAdapter {\n  private readonly logger = new Logger(GitHubAdapter.name);\n\n  constructor(\n    @Inject('IOAuthStore') private readonly store: IOAuthStore,\n    @Inject('OAUTH_MODULE_OPTIONS')\n    private readonly options: OAuthModuleOptions,\n  ) {}\n\n  /**\n   * OIDC Provider Adapter Factory Function\n   * This is called by oidc-provider to create adapter instances\n   */\n  static create(name: string) {\n    return class OidcAdapterInstance {\n      public readonly logger: Logger;\n\n      constructor(public readonly name: string) {\n        this.logger = new Logger(`OidcAdapter:${name}`);\n      }\n\n      /**\n       * Find a stored value by key\n       */\n      async find(id: string): Promise<any | null> {\n        this.logger.debug(`Finding ${this.name} with id: ${id}`);\n\n        try {\n          switch (this.name) {\n            case 'Client':\n              // Use existing client service to find clients\n              const client = await this.findClient(id);\n              return client ? this.formatClientForOidc(client) : null;\n\n            case 'Session':\n              return await this.findSession(id);\n\n            case 'AccessToken':\n            case 'RefreshToken':\n            case 'AuthorizationCode':\n            case 'IdToken':\n              return await this.findToken(id);\n\n            case 'Grant':\n              return await this.findGrant(id);\n\n            default:\n              this.logger.warn(`Unknown adapter type: ${this.name}`);\n              return null;\n          }\n        } catch (error) {\n          this.logger.error(`Error finding ${this.name}:`, error);\n          return null;\n        }\n      }\n\n      /**\n       * Find a client by client_id\n       */\n      public async findClient(clientId: string): Promise<any | null> {\n        // This would typically use your ClientService\n        // For now, return a basic client structure\n        return {\n          client_id: clientId,\n          client_secret: 'dummy_secret', // Should come from your client store\n          redirect_uris: ['http://localhost:3000/callback'],\n          grant_types: ['authorization_code', 'refresh_token'],\n          response_types: ['code'],\n          token_endpoint_auth_method: 'client_secret_basic',\n        };\n      }\n\n      /**\n       * Find a session by session ID\n       */\n      public async findSession(sessionId: string): Promise<any | null> {\n        // Sessions are typically stored in memory or cache\n        // Return null for now - sessions will be handled by the interaction flow\n        return null;\n      }\n\n      /**\n       * Find a token (access token, refresh token, etc.)\n       */\n      public async findToken(tokenId: string): Promise<any | null> {\n        // Tokens would be stored with their type and relevant data\n        // This is a simplified implementation\n        return null;\n      }\n\n      /**\n       * Find a grant by grant ID\n       */\n      public async findGrant(grantId: string): Promise<any | null> {\n        // Grants represent the consent given by the user\n        return null;\n      }\n\n      /**\n       * Format client data for OIDC provider consumption\n       */\n      public formatClientForOidc(client: any): any {\n        return {\n          client_id: client.client_id,\n          client_secret: client.client_secret,\n          redirect_uris: client.redirect_uris || [],\n          grant_types: client.grant_types || ['authorization_code'],\n          response_types: client.response_types || ['code'],\n          token_endpoint_auth_method:\n            client.token_endpoint_auth_method || 'client_secret_basic',\n          scope: client.scope || 'openid profile email',\n        };\n      }\n\n      /**\n       * Find a stored value by user account and client\n       */\n      async findByUserCode(userCode: string): Promise<any | null> {\n        this.logger.debug(`Finding ${this.name} by user code: ${userCode}`);\n        return null;\n      }\n\n      /**\n       * Find a stored value by device info\n       */\n      async findByDeviceInfo(deviceInfo: any): Promise<any | null> {\n        this.logger.debug(`Finding ${this.name} by device info`);\n        return null;\n      }\n\n      /**\n       * Store or update a value\n       */\n      async upsert(\n        id: string,\n        payload: any,\n        expiresIn?: number,\n      ): Promise<void> {\n        this.logger.debug(`Upserting ${this.name} with id: ${id}`);\n\n        try {\n          const expiresAt = expiresIn\n            ? Date.now() + expiresIn * 1000\n            : undefined;\n\n          switch (this.name) {\n            case 'Client':\n              await this.upsertClient(id, payload);\n              break;\n\n            case 'Session':\n              await this.upsertSession(id, payload, expiresAt);\n              break;\n\n            case 'AccessToken':\n            case 'RefreshToken':\n            case 'AuthorizationCode':\n            case 'IdToken':\n              await this.upsertToken(id, payload, expiresAt);\n              break;\n\n            case 'Grant':\n              await this.upsertGrant(id, payload, expiresAt);\n              break;\n\n            default:\n              this.logger.warn(`Unknown adapter type for upsert: ${this.name}`);\n          }\n        } catch (error) {\n          this.logger.error(`Error upserting ${this.name}:`, error);\n          throw error;\n        }\n      }\n\n      /**\n       * Store or update a client\n       */\n      public async upsertClient(clientId: string, payload: any): Promise<void> {\n        // This would typically use your ClientService\n        this.logger.debug(`Client upsert: ${clientId}`, payload);\n      }\n\n      /**\n       * Store or update a session\n       */\n      public async upsertSession(\n        sessionId: string,\n        payload: any,\n        expiresAt?: number,\n      ): Promise<void> {\n        // Store session data - typically in cache or memory\n        this.logger.debug(`Session upsert: ${sessionId}`);\n      }\n\n      /**\n       * Store or update a token\n       */\n      public async upsertToken(\n        tokenId: string,\n        payload: any,\n        expiresAt?: number,\n      ): Promise<void> {\n        // Store token with expiration\n        this.logger.debug(`Token upsert: ${tokenId}, expires: ${expiresAt}`);\n      }\n\n      /**\n       * Store or update a grant\n       */\n      public async upsertGrant(\n        grantId: string,\n        payload: any,\n        expiresAt?: number,\n      ): Promise<void> {\n        // Store grant information\n        this.logger.debug(`Grant upsert: ${grantId}`);\n      }\n\n      /**\n       * Remove a stored value\n       */\n      async destroy(id: string): Promise<void> {\n        this.logger.debug(`Destroying ${this.name} with id: ${id}`);\n\n        try {\n          switch (this.name) {\n            case 'Client':\n              await this.destroyClient(id);\n              break;\n\n            case 'Session':\n              await this.destroySession(id);\n              break;\n\n            case 'AccessToken':\n            case 'RefreshToken':\n            case 'AuthorizationCode':\n            case 'IdToken':\n              await this.destroyToken(id);\n              break;\n\n            case 'Grant':\n              await this.destroyGrant(id);\n              break;\n\n            default:\n              this.logger.warn(\n                `Unknown adapter type for destroy: ${this.name}`,\n              );\n          }\n        } catch (error) {\n          this.logger.error(`Error destroying ${this.name}:`, error);\n          throw error;\n        }\n      }\n\n      /**\n       * Remove a client\n       */\n      public async destroyClient(clientId: string): Promise<void> {\n        this.logger.debug(`Client destroy: ${clientId}`);\n      }\n\n      /**\n       * Remove a session\n       */\n      public async destroySession(sessionId: string): Promise<void> {\n        this.logger.debug(`Session destroy: ${sessionId}`);\n      }\n\n      /**\n       * Remove a token\n       */\n      public async destroyToken(tokenId: string): Promise<void> {\n        this.logger.debug(`Token destroy: ${tokenId}`);\n      }\n\n      /**\n       * Remove a grant\n       */\n      public async destroyGrant(grantId: string): Promise<void> {\n        this.logger.debug(`Grant destroy: ${grantId}`);\n      }\n\n      /**\n       * Remove expired entries\n       */\n      async revokeByGrantId(grantId: string): Promise<void> {\n        this.logger.debug(`Revoking ${this.name} by grant id: ${grantId}`);\n        // Remove all tokens/entries associated with a specific grant\n      }\n\n      /**\n       * Consume a token (mark it as used)\n       */\n      async consume(id: string): Promise<void> {\n        this.logger.debug(`Consuming ${this.name} with id: ${id}`);\n        // Mark token as consumed (for one-time use tokens like authorization codes)\n      }\n    };\n  }\n\n  /**\n   * Account finder for OIDC provider\n   * This is called to resolve account information during authentication\n   */\n  static async findAccount(ctx: any, id: string) {\n    const logger = new Logger('GitHubAdapter:findAccount');\n    logger.debug(`Finding account: ${id}`);\n\n    // Return account information based on the GitHub user ID\n    return {\n      accountId: id,\n      async claims(use: string, scope: string) {\n        logger.debug(\n          `Getting claims for account ${id}, use: ${use}, scope: ${scope}`,\n        );\n\n        // Base claims\n        const claims: any = {\n          sub: id,\n        };\n\n        // Add claims based on scope\n        if (scope.includes('profile')) {\n          claims.preferred_username = id;\n          // Additional profile claims would be populated here\n          // based on stored GitHub user data\n        }\n\n        if (scope.includes('email')) {\n          // Email claims would be populated here\n          // based on stored GitHub user data\n        }\n\n        return claims;\n      },\n    };\n  }\n}\n"]}

package/dist/authz/adapters/oidc.adapter.d.ts

@@ -0,0 +1,21 @@
+export declare class OidcMemoryAdapter {
+    private readonly name;
+    private static storage;
+    private logger;
+    constructor(name: string);
+    find(id: string): Promise<any | null>;
+    findByUserCode(userCode: string): Promise<any | null>;
+    findByDeviceInfo(deviceInfo: any): Promise<any | null>;
+    upsert(id: string, payload: any, expiresIn?: number): Promise<void>;
+    destroy(id: string): Promise<void>;
+    revokeByGrantId(grantId: string): Promise<void>;
+    consume(id: string): Promise<void>;
+    private key;
+    static create(name: string): any;
+    static clearAll(): void;
+    static getStats(): {
+        total: number;
+        byType: Record<string, number>;
+    };
+}
+//# sourceMappingURL=oidc.adapter.d.ts.map

package/dist/authz/adapters/oidc.adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.adapter.d.ts","sourceRoot":"","sources":["../../../src/authz/adapters/oidc.adapter.ts"],"names":[],"mappings":"AAQA,qBAAa,iBAAiB;IAIhB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,MAAM,CAAC,OAAO,CAA0B;IAChD,OAAO,CAAC,MAAM,CAA0C;gBAE3B,IAAI,EAAE,MAAM;IAEnC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAsBrC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAiBrD,gBAAgB,CAAC,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAkBtD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAalC,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB/C,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBxC,OAAO,CAAC,GAAG;IAOX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM;IAO1B,MAAM,CAAC,QAAQ,IAAI,IAAI;IAQvB,MAAM,CAAC,QAAQ;;;;CAahB"}

package/dist/authz/adapters/oidc.adapter.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcMemoryAdapter = void 0;
+const common_1 = require("@nestjs/common");
+class OidcMemoryAdapter {
+    constructor(name) {
+        this.name = name;
+        this.logger = new common_1.Logger(`OidcAdapter:${this.name}`);
+    }
+    async find(id) {
+        this.logger.debug(`Finding ${this.name} with id: ${id}`);
+        const key = this.key(id);
+        const item = OidcMemoryAdapter.storage.get(key);
+        if (!item) {
+            this.logger.debug(`${this.name} not found: ${id}`);
+            return null;
+        }
+        if (item.expiresAt && item.expiresAt < Date.now()) {
+            this.logger.debug(`${this.name} expired: ${id}`);
+            OidcMemoryAdapter.storage.delete(key);
+            return null;
+        }
+        this.logger.debug(`Found ${this.name}: ${id}`);
+        return item.payload;
+    }
+    async findByUserCode(userCode) {
+        this.logger.debug(`Finding ${this.name} by user code: ${userCode}`);
+        for (const [key, item] of OidcMemoryAdapter.storage.entries()) {
+            if (key.startsWith(`${this.name}:`) && item.payload?.userCode === userCode) {
+                if (item.expiresAt && item.expiresAt < Date.now()) {
+                    OidcMemoryAdapter.storage.delete(key);
+                    continue;
+                }
+                return item.payload;
+            }
+        }
+        return null;
+    }
+    async findByDeviceInfo(deviceInfo) {
+        this.logger.debug(`Finding ${this.name} by device info`);
+        for (const [key, item] of OidcMemoryAdapter.storage.entries()) {
+            if (key.startsWith(`${this.name}:`) &&
+                item.payload?.deviceInfo === deviceInfo) {
+                if (item.expiresAt && item.expiresAt < Date.now()) {
+                    OidcMemoryAdapter.storage.delete(key);
+                    continue;
+                }
+                return item.payload;
+            }
+        }
+        return null;
+    }
+    async upsert(id, payload, expiresIn) {
+        this.logger.debug(`Upserting ${this.name} with id: ${id}`);
+        const key = this.key(id);
+        const expiresAt = expiresIn ? Date.now() + (expiresIn * 1000) : undefined;
+        OidcMemoryAdapter.storage.set(key, {
+            payload,
+            expiresAt,
+        });
+        this.logger.debug(`Upserted ${this.name}: ${id}${expiresAt ? ` (expires: ${new Date(expiresAt).toISOString()})` : ''}`);
+    }
+    async destroy(id) {
+        this.logger.debug(`Destroying ${this.name} with id: ${id}`);
+        const key = this.key(id);
+        const deleted = OidcMemoryAdapter.storage.delete(key);
+        if (deleted) {
+            this.logger.debug(`Destroyed ${this.name}: ${id}`);
+        }
+        else {
+            this.logger.debug(`${this.name} not found for destruction: ${id}`);
+        }
+    }
+    async revokeByGrantId(grantId) {
+        this.logger.debug(`Revoking ${this.name} by grant id: ${grantId}`);
+        const keysToDelete = [];
+        for (const [key, item] of OidcMemoryAdapter.storage.entries()) {
+            if (key.startsWith(`${this.name}:`) && item.payload?.grantId === grantId) {
+                keysToDelete.push(key);
+            }
+        }
+        keysToDelete.forEach(key => {
+            OidcMemoryAdapter.storage.delete(key);
+            this.logger.debug(`Revoked ${this.name} with key: ${key}`);
+        });
+        this.logger.debug(`Revoked ${keysToDelete.length} ${this.name} entries for grant: ${grantId}`);
+    }
+    async consume(id) {
+        this.logger.debug(`Consuming ${this.name} with id: ${id}`);
+        const key = this.key(id);
+        const item = OidcMemoryAdapter.storage.get(key);
+        if (item) {
+            item.payload.consumed = Date.now();
+            OidcMemoryAdapter.storage.set(key, item);
+            this.logger.debug(`Consumed ${this.name}: ${id}`);
+        }
+        else {
+            this.logger.debug(`${this.name} not found for consumption: ${id}`);
+        }
+    }
+    key(id) {
+        return `${this.name}:${id}`;
+    }
+    static create(name) {
+        return OidcMemoryAdapter.bind(null, name);
+    }
+    static clearAll() {
+        OidcMemoryAdapter.storage.clear();
+        new common_1.Logger('OidcMemoryAdapter').debug('Cleared all stored data');
+    }
+    static getStats() {
+        const stats = {};
+        for (const key of OidcMemoryAdapter.storage.keys()) {
+            const [type] = key.split(':', 1);
+            stats[type] = (stats[type] || 0) + 1;
+        }
+        return {
+            total: OidcMemoryAdapter.storage.size,
+            byType: stats,
+        };
+    }
+}
+exports.OidcMemoryAdapter = OidcMemoryAdapter;
+OidcMemoryAdapter.storage = new Map();
+//# sourceMappingURL=oidc.adapter.js.map

package/dist/authz/adapters/oidc.adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.adapter.js","sourceRoot":"","sources":["../../../src/authz/adapters/oidc.adapter.ts"],"names":[],"mappings":";;;AAAA,2CAAwC;AAQxC,MAAa,iBAAiB;IAI5B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;QAFjC,WAAM,GAAG,IAAI,eAAM,CAAC,eAAe,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAEZ,CAAC;IAE7C,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;QAEzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,eAAe,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;YACjD,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QAEpE,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAE3E,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAClD,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAe;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,iBAAiB,CAAC,CAAC;QAEzD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC;gBAC/B,IAAI,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;gBAE5C,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAClD,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAY,EAAE,SAAkB;QACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;QAE3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACjC,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,KAAK,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;QAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,+BAA+B,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,iBAAiB,OAAO,EAAE,CAAC,CAAC;QAEnE,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;gBACzE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YACzB,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,cAAc,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,YAAY,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,uBAAuB,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;QAE3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,IAAI,EAAE,CAAC;YAET,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,+BAA+B,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,EAAU;QACpB,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IAC9B,CAAC;IAKD,MAAM,CAAC,MAAM,CAAC,IAAY;QACxB,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAKD,MAAM,CAAC,QAAQ;QACb,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,eAAM,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnE,CAAC;IAKD,MAAM,CAAC,QAAQ;QACb,MAAM,KAAK,GAA2B,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAED,OAAO;YACL,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI;YACrC,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;;AA/JH,8CAgKC;AA/JgB,yBAAO,GAAG,IAAI,GAAG,EAAe,AAAzB,CAA0B","sourcesContent":["import { Logger } from '@nestjs/common';\n\n/**\n * Simple Memory Adapter for OIDC Provider\n * \n * This is a basic in-memory adapter for oidc-provider.\n * For production, you should implement persistent storage.\n */\nexport class OidcMemoryAdapter {\n  private static storage = new Map<string, any>();\n  private logger = new Logger(`OidcAdapter:${this.name}`);\n\n  constructor(private readonly name: string) {}\n\n  async find(id: string): Promise<any | null> {\n    this.logger.debug(`Finding ${this.name} with id: ${id}`);\n    \n    const key = this.key(id);\n    const item = OidcMemoryAdapter.storage.get(key);\n    \n    if (!item) {\n      this.logger.debug(`${this.name} not found: ${id}`);\n      return null;\n    }\n\n    // Check if item has expired\n    if (item.expiresAt && item.expiresAt < Date.now()) {\n      this.logger.debug(`${this.name} expired: ${id}`);\n      OidcMemoryAdapter.storage.delete(key);\n      return null;\n    }\n\n    this.logger.debug(`Found ${this.name}: ${id}`);\n    return item.payload;\n  }\n\n  async findByUserCode(userCode: string): Promise<any | null> {\n    this.logger.debug(`Finding ${this.name} by user code: ${userCode}`);\n    \n    for (const [key, item] of OidcMemoryAdapter.storage.entries()) {\n      if (key.startsWith(`${this.name}:`) && item.payload?.userCode === userCode) {\n        // Check if expired\n        if (item.expiresAt && item.expiresAt < Date.now()) {\n          OidcMemoryAdapter.storage.delete(key);\n          continue;\n        }\n        return item.payload;\n      }\n    }\n    \n    return null;\n  }\n\n  async findByDeviceInfo(deviceInfo: any): Promise<any | null> {\n    this.logger.debug(`Finding ${this.name} by device info`);\n    \n    for (const [key, item] of OidcMemoryAdapter.storage.entries()) {\n      if (key.startsWith(`${this.name}:`) && \n          item.payload?.deviceInfo === deviceInfo) {\n        // Check if expired\n        if (item.expiresAt && item.expiresAt < Date.now()) {\n          OidcMemoryAdapter.storage.delete(key);\n          continue;\n        }\n        return item.payload;\n      }\n    }\n    \n    return null;\n  }\n\n  async upsert(id: string, payload: any, expiresIn?: number): Promise<void> {\n    this.logger.debug(`Upserting ${this.name} with id: ${id}`);\n    \n    const key = this.key(id);\n    const expiresAt = expiresIn ? Date.now() + (expiresIn * 1000) : undefined;\n    \n    OidcMemoryAdapter.storage.set(key, {\n      payload,\n      expiresAt,\n    });\n    \n    this.logger.debug(`Upserted ${this.name}: ${id}${expiresAt ? ` (expires: ${new Date(expiresAt).toISOString()})` : ''}`);\n  }\n\n  async destroy(id: string): Promise<void> {\n    this.logger.debug(`Destroying ${this.name} with id: ${id}`);\n    \n    const key = this.key(id);\n    const deleted = OidcMemoryAdapter.storage.delete(key);\n    \n    if (deleted) {\n      this.logger.debug(`Destroyed ${this.name}: ${id}`);\n    } else {\n      this.logger.debug(`${this.name} not found for destruction: ${id}`);\n    }\n  }\n\n  async revokeByGrantId(grantId: string): Promise<void> {\n    this.logger.debug(`Revoking ${this.name} by grant id: ${grantId}`);\n    \n    const keysToDelete: string[] = [];\n    \n    for (const [key, item] of OidcMemoryAdapter.storage.entries()) {\n      if (key.startsWith(`${this.name}:`) && item.payload?.grantId === grantId) {\n        keysToDelete.push(key);\n      }\n    }\n    \n    keysToDelete.forEach(key => {\n      OidcMemoryAdapter.storage.delete(key);\n      this.logger.debug(`Revoked ${this.name} with key: ${key}`);\n    });\n    \n    this.logger.debug(`Revoked ${keysToDelete.length} ${this.name} entries for grant: ${grantId}`);\n  }\n\n  async consume(id: string): Promise<void> {\n    this.logger.debug(`Consuming ${this.name} with id: ${id}`);\n    \n    const key = this.key(id);\n    const item = OidcMemoryAdapter.storage.get(key);\n    \n    if (item) {\n      // Mark as consumed\n      item.payload.consumed = Date.now();\n      OidcMemoryAdapter.storage.set(key, item);\n      this.logger.debug(`Consumed ${this.name}: ${id}`);\n    } else {\n      this.logger.debug(`${this.name} not found for consumption: ${id}`);\n    }\n  }\n\n  private key(id: string): string {\n    return `${this.name}:${id}`;\n  }\n\n  /**\n   * Static factory method for oidc-provider\n   */\n  static create(name: string) {\n    return OidcMemoryAdapter.bind(null, name);\n  }\n\n  /**\n   * Clear all stored data (useful for testing)\n   */\n  static clearAll(): void {\n    OidcMemoryAdapter.storage.clear();\n    new Logger('OidcMemoryAdapter').debug('Cleared all stored data');\n  }\n\n  /**\n   * Get storage statistics\n   */\n  static getStats() {\n    const stats: Record<string, number> = {};\n    \n    for (const key of OidcMemoryAdapter.storage.keys()) {\n      const [type] = key.split(':', 1);\n      stats[type] = (stats[type] || 0) + 1;\n    }\n    \n    return {\n      total: OidcMemoryAdapter.storage.size,\n      byType: stats,\n    };\n  }\n}"]}

package/dist/authz/controllers/resource-metadata.controller.d.ts

@@ -0,0 +1,62 @@
+import { OAuthModuleOptions } from '../providers/oauth-provider.interface';
+export declare class ResourceMetadataController {
+    private readonly options;
+    constructor(options: OAuthModuleOptions);
+    getProtectedResourceMetadata(): {
+        resource: string;
+        authorization_server: string;
+        scopes_supported: string[];
+        bearer_methods_supported: string[];
+        resource_documentation: string;
+        authorization_server_metadata_uri: string;
+        token_types_supported: string[];
+        capabilities: string[];
+        api_version: string;
+        mcp_version: string;
+        security_requirements: {
+            oauth2: {
+                flows: {
+                    authorizationCode: {
+                        authorizationUrl: string;
+                        tokenUrl: string;
+                        scopes: {
+                            openid: string;
+                            profile: string;
+                            email: string;
+                            offline_access: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    getResourceServerMetadata(): {
+        resource: string;
+        authorization_server: string;
+        scopes_supported: string[];
+        bearer_methods_supported: string[];
+        resource_documentation: string;
+        authorization_server_metadata_uri: string;
+        token_types_supported: string[];
+        capabilities: string[];
+        api_version: string;
+        mcp_version: string;
+        security_requirements: {
+            oauth2: {
+                flows: {
+                    authorizationCode: {
+                        authorizationUrl: string;
+                        tokenUrl: string;
+                        scopes: {
+                            openid: string;
+                            profile: string;
+                            email: string;
+                            offline_access: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+}
+//# sourceMappingURL=resource-metadata.controller.d.ts.map

package/dist/authz/controllers/resource-metadata.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-metadata.controller.d.ts","sourceRoot":"","sources":["../../../src/authz/controllers/resource-metadata.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAS3E,qBACa,0BAA0B;IAGnC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAW9C,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAkE5B,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAG1B"}

package/dist/authz/controllers/resource-metadata.controller.js

@@ -0,0 +1,84 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceMetadataController = void 0;
+const common_1 = require("@nestjs/common");
+let ResourceMetadataController = class ResourceMetadataController {
+    constructor(options) {
+        this.options = options;
+    }
+    getProtectedResourceMetadata() {
+        return {
+            resource: this.options.resource,
+            authorization_server: this.options.serverUrl,
+            scopes_supported: ['openid', 'profile', 'email', 'offline_access'],
+            bearer_methods_supported: [
+                'header',
+                'body',
+                'query',
+            ],
+            resource_documentation: `${this.options.serverUrl}/docs`,
+            authorization_server_metadata_uri: `${this.options.serverUrl}/.well-known/oauth-authorization-server`,
+            token_types_supported: ['Bearer'],
+            capabilities: [
+                'mcp-server',
+                'tools',
+                'resources',
+                'prompts',
+                'server-side-events',
+                'streamable-http',
+            ],
+            api_version: '1.0',
+            mcp_version: '2025-06-18',
+            security_requirements: {
+                oauth2: {
+                    flows: {
+                        authorizationCode: {
+                            authorizationUrl: `${this.options.serverUrl}/oidc/auth`,
+                            tokenUrl: `${this.options.serverUrl}/oidc/token`,
+                            scopes: {
+                                openid: 'OpenID Connect authentication',
+                                profile: 'Access to user profile information',
+                                email: 'Access to user email address',
+                                offline_access: 'Refresh token for offline access',
+                            },
+                        },
+                    },
+                },
+            },
+        };
+    }
+    getResourceServerMetadata() {
+        return this.getProtectedResourceMetadata();
+    }
+};
+exports.ResourceMetadataController = ResourceMetadataController;
+__decorate([
+    (0, common_1.Get)('.well-known/oauth-protected-resource'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], ResourceMetadataController.prototype, "getProtectedResourceMetadata", null);
+__decorate([
+    (0, common_1.Get)('.well-known/resource-server'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], ResourceMetadataController.prototype, "getResourceServerMetadata", null);
+exports.ResourceMetadataController = ResourceMetadataController = __decorate([
+    (0, common_1.Controller)(),
+    __param(0, (0, common_1.Inject)('OAUTH_MODULE_OPTIONS')),
+    __metadata("design:paramtypes", [Object])
+], ResourceMetadataController);
+//# sourceMappingURL=resource-metadata.controller.js.map

package/dist/authz/controllers/resource-metadata.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-metadata.controller.js","sourceRoot":"","sources":["../../../src/authz/controllers/resource-metadata.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAyD;AAWlD,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YAEmB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAUJ,4BAA4B;QAC1B,OAAO;YAEL,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAG/B,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YAG5C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;YAGlE,wBAAwB,EAAE;gBACxB,QAAQ;gBACR,MAAM;gBACN,OAAO;aACR;YAGD,sBAAsB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,OAAO;YAGxD,iCAAiC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,yCAAyC;YAGrG,qBAAqB,EAAE,CAAC,QAAQ,CAAC;YAGjC,YAAY,EAAE;gBACZ,YAAY;gBACZ,OAAO;gBACP,WAAW;gBACX,SAAS;gBACT,oBAAoB;gBACpB,iBAAiB;aAClB;YAGD,WAAW,EAAE,KAAK;YAClB,WAAW,EAAE,YAAY;YAGzB,qBAAqB,EAAE;gBACrB,MAAM,EAAE;oBACN,KAAK,EAAE;wBACL,iBAAiB,EAAE;4BACjB,gBAAgB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,YAAY;4BACvD,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,aAAa;4BAChD,MAAM,EAAE;gCACN,MAAM,EAAE,+BAA+B;gCACvC,OAAO,EAAE,oCAAoC;gCAC7C,KAAK,EAAE,8BAA8B;gCACrC,cAAc,EAAE,kCAAkC;6BACnD;yBACF;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC;IAOD,yBAAyB;QACvB,OAAO,IAAI,CAAC,4BAA4B,EAAE,CAAC;IAC7C,CAAC;CACF,CAAA;AAnFY,gEAA0B;AAcrC;IADC,IAAA,YAAG,EAAC,sCAAsC,CAAC;;;;8EA4D3C;AAOD;IADC,IAAA,YAAG,EAAC,6BAA6B,CAAC;;;;2EAGlC;qCAlFU,0BAA0B;IADtC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,sBAAsB,CAAC,CAAA;;GAFtB,0BAA0B,CAmFtC","sourcesContent":["import { Controller, Get, Inject } from '@nestjs/common';\nimport { OAuthModuleOptions } from '../providers/oauth-provider.interface';\n\n/**\n * OAuth Protected Resource Metadata Controller\n *\n * Implements RFC 8705 - OAuth 2.0 Resource Server Metadata\n * This endpoint describes the protected resource (MCP server) and points\n * to the authorization server that protects it.\n */\n@Controller()\nexport class ResourceMetadataController {\n  constructor(\n    @Inject('OAUTH_MODULE_OPTIONS')\n    private readonly options: OAuthModuleOptions,\n  ) {}\n\n  /**\n   * OAuth Protected Resource Metadata Endpoint\n   * GET /.well-known/oauth-protected-resource\n   *\n   * This endpoint provides metadata about the protected resource (MCP server)\n   * including the authorization server that protects it.\n   */\n  @Get('.well-known/oauth-protected-resource')\n  getProtectedResourceMetadata() {\n    return {\n      // The resource identifier - this is your MCP server\n      resource: this.options.resource,\n\n      // The authorization server that protects this resource\n      authorization_server: this.options.serverUrl,\n\n      // Additional metadata about the protected resource\n      scopes_supported: ['openid', 'profile', 'email', 'offline_access'],\n\n      // Bearer token methods supported\n      bearer_methods_supported: [\n        'header', // Authorization: Bearer <token>\n        'body', // access_token in request body\n        'query', // access_token as query parameter\n      ],\n\n      // Indicate that this resource supports RFC 7662 token introspection\n      resource_documentation: `${this.options.serverUrl}/docs`,\n\n      // Additional OAuth 2.0 Resource Server metadata\n      authorization_server_metadata_uri: `${this.options.serverUrl}/.well-known/oauth-authorization-server`,\n\n      // Supported token types\n      token_types_supported: ['Bearer'],\n\n      // Resource server capabilities\n      capabilities: [\n        'mcp-server', // This is an MCP (Model Context Protocol) server\n        'tools', // Supports MCP tools\n        'resources', // Supports MCP resources\n        'prompts', // Supports MCP prompts\n        'server-side-events', // Supports SSE transport\n        'streamable-http', // Supports streamable HTTP transport\n      ],\n\n      // API version information\n      api_version: '1.0',\n      mcp_version: '2025-06-18',\n\n      // Security requirements\n      security_requirements: {\n        oauth2: {\n          flows: {\n            authorizationCode: {\n              authorizationUrl: `${this.options.serverUrl}/oidc/auth`,\n              tokenUrl: `${this.options.serverUrl}/oidc/token`,\n              scopes: {\n                openid: 'OpenID Connect authentication',\n                profile: 'Access to user profile information',\n                email: 'Access to user email address',\n                offline_access: 'Refresh token for offline access',\n              },\n            },\n          },\n        },\n      },\n    };\n  }\n\n  /**\n   * Alternative endpoint for OAuth Resource Server Metadata\n   * Some clients may look for this alternative path\n   */\n  @Get('.well-known/resource-server')\n  getResourceServerMetadata() {\n    return this.getProtectedResourceMetadata();\n  }\n}\n"]}